Veragent

io.github.lixiaowwwPublished by GitHub account lixiaowwwv0.1.1Updated Oct 24, 2026

Check the trust/security score of MCP servers, agents, skills & CLIs before you install them.

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Veragent lets an assistant look up trust and security scores for MCP servers, agents, skills and CLIs before installing them, backed by the Veragent trust API.

What you can do
Check a tool's trust score and audit state by name before installing it, with heuristic and certified results distinguished. List the most trusted MCP tools, optionally filtered by a query. Score an entire MCP configuration file, returning per-server risk and a summary.
When to use it
Useful when deciding whether to install an MCP server, agent, skill or CLI and you want a third-party trust signal first, or when auditing an existing MCP configuration for risky entries.
Requirements
Runs locally as a Python package (veragent-mcp) launched via uvx or pip; network access to the Veragent API, whose base can be overridden with the VERAGENT_API_BASE environment variable. No authentication is declared.
Before you install
Queries and configuration contents, including server names, are sent to the third-party Veragent API. Scores are partly heuristic static analysis rather than behavioral testing, so treat them as one signal, not a guarantee.

Installation

In SourceWeft

  1. Open Veragent in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

Veragent MCP Server

The trust layer for MCP — as an MCP tool. Let Claude (or any MCP client/agent) check whether an MCP tool is safe before installing it, look up the most trusted tools, or score an entire MCP stack — all backed by the Veragent trust registry.

⭐ Star this repo  ·  uvx veragent-mcp — check any tool's trust before you install  ·  Get your tool SGC Certified →  ·  How we audit (open methodology) →

Tools

ToolWhat it does
check_tool_trust(name)Veragent trust score + audit state for a tool/server/agent. Use before installing.
list_trusted_tools(query, limit)The most trusted MCP tools, optionally filtered.
scan_mcp_stack(mcp_config)Score a whole mcp_settings.json — per-server risk + summary.

Install (Claude Desktop)

Add to your claude_desktop_config.json:

json
{  "mcpServers": {    "veragent": {      "command": "uvx",      "args": ["veragent-mcp"]    }  }}

Then ask Claude: "Is the playwright-mcp server safe? Check Veragent."

Run locally

bash
uvx veragent-mcp# orpip install veragent-mcp && veragent-mcp

Configuration

  • VERAGENT_API_BASE — override the API base (default https://veragent.store/api/v1).

Honesty

Veragent labels static-analysis results as Heuristic and reserves SGC Certified for behavioral-sandbox passes. Scores are reported with this distinction.

Source: README.md at commit c1b4ee0

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.1LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts